diff options
| author | Roger Dingledine <arma@torproject.org> | 2005-02-24 10:22:00 +0000 |
|---|---|---|
| committer | Roger Dingledine <arma@torproject.org> | 2005-02-24 10:22:00 +0000 |
| commit | 8054f82992105c5e69f7ea10c578e23479234e8a (patch) | |
| tree | 051f313bc7e9e5129682ed2ea09df7ee89f29989 | |
| parent | 043fd5666fd81aa6b507cd7725f721849b2f3797 (diff) | |
| download | tor-8054f82992105c5e69f7ea10c578e23479234e8a.tar.gz tor-8054f82992105c5e69f7ea10c578e23479234e8a.zip | |
stop a potential overflow (pointed out by ilja)
svn:r3681
| -rw-r--r-- | src/or/relay.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/src/or/relay.c b/src/or/relay.c index a403875f67..4029823c85 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -436,8 +436,10 @@ int connection_edge_send_command(connection_t *fromconn, circuit_t *circ, rh.stream_id = fromconn->stream_id; /* else it's 0 */ rh.length = payload_len; relay_header_pack(cell.payload, &rh); - if (payload_len) + if (payload_len) { + tor_assert(payload_len <= RELAY_PAYLOAD_SIZE); memcpy(cell.payload+RELAY_HEADER_SIZE, payload, payload_len); + } log_fn(LOG_DEBUG,"delivering %d cell %s.", relay_command, cell_direction == CELL_DIRECTION_OUT ? "forward" : "backward"); |